/*
** Copyright (C) 2010 Calin Radoni
**
** This file is part of CHScanner.
**
** CHScanner is free software: you can redistribute it and/or modify
** it under the terms of the GNU General Public License as published by
** the Free Software Foundation, either version 3 of the License, or
** (at your option) any later version.
**
** CHScanner is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
** GNU General Public License for more details.
**
** You should have received a copy of the GNU General Public License
** along with CHScanner. If not, see <http://www.gnu.org/licenses/>.
*/

#include "StdAfx.h"
#include ".\meventlogrecord.h"

MEventLogRecord::MEventLogRecord(void)
{
}

MEventLogRecord::~MEventLogRecord(void)
{
}

bool MEventLogRecord::GetAccountName(PSID sidIn, LPCTSTR machineNameIn)
{
	BOOL res;
	DWORD sizeName, sizeDomain;

	if(sidIn==NULL) return false;

	if(!IsValidSid(sidIn)) return false;

	SecureZeroMemory(userName,   MAX_SID_NAME_SIZE * sizeof(TCHAR));
	SecureZeroMemory(domainName, MAX_SID_NAME_SIZE * sizeof(TCHAR));

	sizeName   = MAX_SID_NAME_SIZE;
	sizeDomain = MAX_SID_NAME_SIZE;
	res = LookupAccountSid(machineNameIn, sidIn, userName, &sizeName, domainName, &sizeDomain, &sidNameUse);
	if(!res){
		DWORD err;
		err = GetLastError();
		err = err;
	}

	return true;
}

void MEventLogRecord::Initialize(void)
{
	recordNumber  = 0;
	timeGenerated = 0;
	timeWritten   = 0;

	eventId       = 0;
	eventType     = 0;
	eventCategory = 0;

	numStrings    = 0;

	SecureZeroMemory(userName,   MAX_SID_NAME_SIZE * sizeof(TCHAR));
	SecureZeroMemory(domainName, MAX_SID_NAME_SIZE * sizeof(TCHAR));
	sidNameUse    = SidTypeInvalid;

	SecureZeroMemory(message,    MAX_MESSAGE_SIZE  * sizeof(TCHAR));
}

bool MEventLogRecord::Set(LPCTSTR machineNameIn, BYTE* dataIn, DWORD sizeIn)
{
	EVENTLOGRECORD *elr;
	DWORD reqSize;
	PSID userSid;

	Initialize();
	
	if(dataIn==NULL) return false;
	if(sizeIn<sizeof(EVENTLOGRECORD)) return false;

	elr = (EVENTLOGRECORD*)dataIn;

	recordNumber  = elr->RecordNumber;
	timeGenerated = elr->TimeGenerated;
	timeWritten   = elr->TimeWritten;

	eventId       = elr->EventID;
	eventType     = elr->EventType;
	eventCategory = elr->EventCategory;

	numStrings    = elr->NumStrings;

	reqSize  = elr->UserSidOffset;
	reqSize += elr->UserSidLength;
	if(reqSize>sizeIn){
		Initialize();
		return false;
	}

	if(elr->UserSidLength>0){
		userSid = (PSID)(&(dataIn[elr->UserSidOffset]));
		if(!GetAccountName(userSid, machineNameIn)){
			Initialize();
			return false;
		}
	}

	if(elr->DataLength>0){
		reqSize  = elr->DataOffset;
		reqSize += elr->DataLength;
		if(reqSize>sizeIn){
			Initialize();
			return false;
		}
	}

	TCHAR* sourceName;
	TCHAR* computerName;

	sourceName   = (TCHAR*)(&(dataIn[sizeof(EVENTLOGRECORD)]));
	computerName = (TCHAR*)(&(dataIn[sizeof(EVENTLOGRECORD) + _tcslen(sourceName) + 1]));
	elr = elr;

	return true;
}
